﻿<?xml version="1.0" encoding="utf-8"?>
<!--Code Generated Analysis XML-->
<ULA>
  <Configuration>
    <Version>1.0.0</Version>
    <Product>SharePoint Server</Product>
    <Analysis>
      <Category>Miscellaneous</Category>
      <XMLDescription>Miscellaneous</XMLDescription>
    </Analysis>
  </Configuration>
  <ULAQuery>
    <Query>
	<ID>476953a5-67de-4612-9429-bc66a53b09fa</ID>
	<Title>ULS usage log reaching maximum size - Event 8095 </Title>
	<Parameters>
		<EventID>8095 </EventID>
		<Message>http://technet.microsoft.com/en-us/library/ff182791</Message>
		<SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8095'</SQLQuery>
		<RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8095'</RelevantLogCollection>
		<Symptom>This event appears in the event log: Event ID: 8095 Description: Usage logs are reaching to the configured storage limit [configured limit]. Please increase the maximum storage settings. Otherwise, older files will be deleted once the limit is reached.
</Symptom>
		<Description> The SharePoint 2010 Tracing Service (SPTracev4) is used by Microsoft SharePoint Foundation 2010 to manage usage log output. When usage logging is enabled, administrators can specify the path used to store the usage log file. This log file is used by many applications that are built on SharePoint Foundation 2010. This event occurs when the configured log file location is low on space. It serves as a warning that logging may stop soon unless more space is made available or the space allocated to logging is increased.</Description>
		<Cause>The configured log file location has insufficient free disk space for logging, or the maximum space allocated for logging is too low.
</Cause>
		<Articles>http://technet.microsoft.com/en-us/library/ff182791</Articles>
	</Parameters>
</Query>
    <Query>
      <ID>1e6fb8c2-9fc9-4088-87c4-f69e307d217b</ID>
      <Title>ULS trace log reaching maximum size - Event 8094 </Title>
      <Parameters>
        <EventID>8094 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ee924654</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8094'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8094'</RelevantLogCollection>
        <Symptom>This event appears in the event log: Event ID: 8094 Description: Trace logs are reaching to the configured storage limit [configured limit]. Please increase the maximum storage settings. Otherwise, older files will be deleted once the limit is reached.
</Symptom>
        <Description>The SharePoint 2010 Tracing Service (SPTracev4) is used by Microsoft SharePoint Foundation 2010 to manage trace message output. When trace logging is enabled, administrators can specify the path used to store the trace log file. This log file is used by many applications that are built on SharePoint Foundation 2010. This event occurs when the configured log file location is low on space. It serves as a warning that logging may stop soon unless more space is made available or the space allocated to logging is increased.
</Description>
        <Cause>The configured log file location has insufficient free disk space for logging, or the maximum space allocated for logging is too low.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee924654</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>a9a74e91-6c49-4e5a-bc91-211c6d35f501</ID>
      <Title>Log folder does not exist - Event 8074 </Title>
      <Parameters>
        <EventID>8074 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ff453925</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8074'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8074'</RelevantLogCollection>
        <Symptom>This event appears in the event log: Event ID: 8074 Description: Unable to access directory [directoryname] on server [servername]. Ensure that this directory exists and that the account [domain]\[username] can access it.</Symptom>
        <Description> The logging folder specified in the error message does not exist or cannot be accessed.</Description>
        <Cause>One or more of the following might be the cause:

The folder does not exist.


The SharePoint 2010 Tracing Service (SPTraceV4) account does not have permissions to read and write to this folder.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ff453925</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>b0825167-f78d-4cff-b437-d85283b8529f</ID>
      <Title>Access denied for writing to disk - Event 6589 </Title>
      <Parameters>
        <EventID>6589 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ee513063</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6589'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6589'</RelevantLogCollection>
        <Symptom>The following symptoms might appear:

Files might not be updated correctly to reflect configured settings.


This event appears in the event log: Event ID: 6589 Description: The application pool account [Account Name] has insufficient permissions to write file [File Name] at [File Location]. Additional information is below.</Symptom>
        <Description>This error occurs when anInternet Information Services (IIS) 7.0 application pool used by Microsoft SharePoint Foundation 2010 attempts to update a file or folder and is denied access because the service account used by the application pool has inadequate permissions.
</Description>
        <Cause>The service account for the IIS application pool that SharePoint Foundation 2010 uses does not have appropriate permissions to write to a file or folder in the NTFS file system.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513063</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>01f6e21a-f47d-4bd4-9dc5-5b79f185f803</ID>
      <Title>Access denied for writing to registry - Event 6588 </Title>
      <Parameters>
        <EventID>6588 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ee513047</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6588'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6588'</RelevantLogCollection>
        <Symptom>The following symptoms might appear:

Registry keys might not be updated correctly to reflect configured settings.


This event appears in the event log: Event ID: 6588 Description: The application pool account [Account Name] cannot write registry key [Key Name] at [Key Location]. Additional information is below.</Symptom>
        <Description> This error occurs when an Internet Information Services application pool that is used by Microsoft SharePoint Foundation 2010 attempts to update a registry key and is denied access because the service account that is used by the application pool has inadequate permissions.
</Description>
        <Cause>The service account for the IIS application pool that SharePoint Foundation 2010 does not have appropriate access permissions to write to a registry key.
</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513047</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>e29d230b-9e62-4153-bf12-0da6902974ff</ID>
      <Title>ULS not enough free disk space - Event 6457 </Title>
      <Parameters>
        <EventID>6457 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ee513054</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6457'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6457'</RelevantLogCollection>
        <Symptom>The following symptoms might appear:

The trace log shows no new data.


This event appears in the event log: Event ID: 6457 Description: Not enough free disk space available. The tracing service has temporarily stopped outputting trace messages to the log file. Tracing will resume when more than [# of MBs needed to resume logging] MB of disk space becomes available.
</Symptom>
        <Description>The Microsoft SharePoint Foundation Tracing (SPTracev4) service is used by Microsoft SharePoint Foundation 2010 to manage trace message output. When trace logging is turned on, administrators can specify the path that is to be used to store the trace logs. This log file is used by many applications that are built on top of SharePoint Foundation. The trace log contains information that is useful for diagnosing server problems. SharePoint Foundation 2010 could not write to the trace log. This event occurs when not enough free space is available for logging.
</Description>
        <Cause>The configured log location does not have sufficient free disk space for logging.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513054</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>86f921bf-e1ef-4047-8d73-89d445e57fa8</ID>
      <Title>Event log flooding - Events 2158 2159 </Title>
      <Parameters>
        <EventID>Events 2158 or 2159 </EventID>
        <Message />
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '2158' OR EventID = '2159'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '2158' OR EventID = '2159'</RelevantLogCollection>
        <Symptom>This event appears in the event log: Event ID: 2158 or 2159 Description: Event [Event ID] ([Event Provider Name]) of severity [Event Severity] occurred [Number of occurrences] more time(s) and was suppressed in the event log.</Symptom>
        <Description>Event log flood protection prevents repeated events from being logged to the Windows event log. When an event is logged several times in a short period, flood protection prevents future events of the same type from being logged.</Description>
        <Cause>The same event is being logged repeatedly, triggering event log flood protection. You can identify which event is being logged repeatedly in the Event Description text of Event ID 2158 or 2159.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513068</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>85667be1-dd15-41c6-9d16-c22933275d33</ID>
      <Title>ULS not enough storage for log directory - Event 2150</Title>
      <Parameters>
        <EventID>2150</EventID>
        <Message>Free up disk space or relocate the usage log
SharePoint Foundation 2010 could not write to the usage log. This usage log contains information that is helpful for usage tracking and reporting.

To free up disk space:

Use Disk Cleanup to free up disk space where the usage log files are stored.

Verify whether the trace log has enough disk space to run properly.

If disk space is inadequate, try to clean the Temp folders on the drive.

If this procedure does not solve the problem, you can relocate the usage log file to a partition that has more drive space.

To relocate the log file:

On the SharePoint Central Administration Web site, on the Quick Launch, click Monitoring and in the Reporting section click Usage Logging.

On the Usage Logging page, in the Logging Settings section, type the new location for the usage log file.

Click OK.

To check the usage log file:

To verify that Microsoft SharePoint Foundation 2010 can create and write to the usage log file, on the Central Administration page click Monitoring, and in the Reporting section click Usage Logging.

On the Usage Logging page, in the Logging Settings section, copy the path of the usage log file.

In Windows Explorer, navigate to the usage log file by using the copied path. Usage log files are in binary format and the contents cannot be easily viewed and understood. The file size of the usage log increases over time and confirms that usage logging is working.</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '2150'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '2150'</RelevantLogCollection>
        <Symptom>One or more of the following symptoms might appear:
The usage log shows no new usage data.
This event appears in the event log: Event ID: 2150 Description: Failed to create a usage log file at [Log Location]. There must be at least [# of GBs needed to resume logging] GB of free space if the usage logs are on System Drive.
</Symptom>
        <Description>The Microsoft SharePoint Foundation Tracing (SPTracev4) service is used by Microsoft SharePoint Foundation 2010 to manage usage log output. When usage logging is turned on, administrators can specify the path that is used to store the usage logs. This log file is used by many applications that are built on top of SharePoint Foundation 2010. This event occurs when not enough free space is available for logging.</Description>
        <Cause>The configured log location does not have enough free disk space for logging.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513062</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>31ee1b3e-ecfe-4b0f-80ee-ca15e860a6d6</ID>
      <Title>Unable to write to trace log</Title>
      <Parameters>
        <EventID>5401</EventID>
        <Message>Check the event log
This error can occur for multiple reasons. The error number and error description describe the cause of the error in more detail; use the information in the error description to determine the most appropriate troubleshooting steps.

</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '5401'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '5401'</RelevantLogCollection>
        <Symptom>The following symptoms might appear:

ULS trace log files are not created.


This event appears in the event log: Event ID: 5401 Tracing Service failed to create the trace log file at [Log Location]. Error [Error Number]: [Error Description].
</Symptom>
        <Description>Unified Logging Service (ULS) trace logs contain diagnostic information about what is happening on a Microsoft SharePoint Foundation 2010 server. This information can be used to diagnose problems on your server if they occur.
</Description>
        <Cause> This error occurs when the tracing service cannot create a new log file.
This error occurs when the tracing service cannot create a new log file.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513052</Articles>
      </Parameters>
    </Query>
  </ULAQuery>
</ULA>